Passkeys resist phishing only if recovery does too

A passkey replaces a reusable secret with a cryptographic credential tied to the real website or app. That makes it resistant to the familiar fake-login-page attack: the credential will not authenticate to the wrong domain. But a strong front door can still be bypassed through a weak recovery route.

CISA describes FIDO/WebAuthn as the widely available phishing-resistant authentication option and notes that it blocks a login attempt at a malicious site (CISA). FIDO Alliance guidance emphasizes that full phishing prevention requires strengthening both sign-in and recovery (FIDO Alliance).

Know which passkey you created

A synced passkey can follow you through an Apple, Google, Microsoft, or password-manager account. That improves recovery across devices but makes the security of that credential-manager account important. A device-bound passkey or hardware security key stays on one authenticator, offering stronger control but requiring a second recovery path.

Your face, fingerprint, or device PIN usually unlocks the private key locally; the service receives a cryptographic proof, not the biometric. A passkey does not prevent malware, an unlocked-device thief, a fraudulent support reset, or a user approving a separate payment scam.

Build recovery before removing fallbacks

For each important financial and email account, record:

• where the passkey is stored;
• a second enrolled device or hardware key;
• recovery email and phone number;
• backup codes stored offline, if offered;
• the provider’s official recovery URL and support channel;
• whether SMS remains enabled as a fallback.

Test with a second device while the first is available. Do not intentionally lock yourself out of a bank account just to test support. CISA warns that services may still default to SMS in recovery even after stronger authentication is enrolled; that fallback can preserve the attack path (CISA mobile guidance).

Document the result without copying the private credential itself: account, authenticator type, backup location, date tested, and recovery channel. If a household shares finances, decide who can recover a joint service and who should not have access to an individual account. A recovery plan that exists only in one person’s memory can fail during travel, illness, or device loss.

Run a safe phishing check

When a message says “verify your account,” do not use its link. Open the saved app or type the known domain. A real passkey prompt should be associated with that service. Never read a one-time code to a caller or approve a prompt you did not initiate.

Passkeys reduce credential phishing; they do not authenticate the human who calls claiming to be fraud support. Use a separate callback channel, just as the voice-clone callback protocol recommends.

Plan for a lost phone

If passkeys sync, confirm you can access the credential manager from another trusted device without relying solely on the lost phone. If they are device-bound, enroll another authenticator in advance. Keep the recovery inventory outside the phone, but do not store unencrypted backup codes beside a list of account names.

A hypothetical user might keep one synced passkey on a phone and laptop, plus a hardware key in secure storage. The bank may still retain SMS recovery. The remaining task is to ask whether SMS can be disabled and how identity is verified after all devices are lost. The answer is provider-specific.

Review the whole account chain

Secure the primary email and mobile-carrier account at least as carefully as the bank because they can receive resets. Turn on transaction and login alerts. Remove old devices and stale recovery addresses. Revisit the setup after replacing a phone, changing a number, or leaving a shared credential manager.

If a device is actually missing, follow lost-phone payment-account response in priority order. If an app does not support passkeys, use the strongest option it offers, unique stored passwords, and alerts; do not mistake “passkeys unavailable” for “nothing can be improved.”

Sources

• CISA, More than a Password
• CISA, Mobile Communications Best Practice Guidance
• FIDO Alliance, Passkeys: The Journey to Prevent Phishing Attacks